Anthropic CCAR-P Test Passed : Claude Certified Architect - Professional

You are preparing a HIPAA-eligible deployment for a healthcare customer.
Which configuration supports HIPAA compliance using Anthropic-offered tools?

• A. Claude Free with no contractual addendum, since consumer products meet HIPAA requirements out of the box.
• B. Disabling all audit logging so that no PHI is recorded in any log store, on the assumption that the absence of logs satisfies HIPAA requirements without a signed BAA.
• C. An ad-hoc personal Claude account used by individual clinicians for PHI-related tasks, with no Business Associate Agreement, no Zero Data Retention, and no audit logging configured.
• D. Claude Enterprise with a signed Business Associate Agreement, Zero Data Retention enabled, and audit logging configured for compliance tracking.

You are responding to an adversarial input pattern in which users include text claiming admin authority and instructing the model to bypass safety restrictions.
Which combination of controls most effectively mitigates this attack pattern?

• A. Prompt-level instructions that treat user content as untrusted data, runtime classifiers that detect override attempts, scoped tool permissions that cannot be elevated by user content, and audit logging of attempts.
• B. Granting users any privilege level they assert in their message content, on the assumption that cooperative behavior requires honoring self-declared authority without independent verification.
• C. Trusting that the model will intrinsically recognize and reject all bypass attempts without prompt-level instructions, runtime classifiers, scoped permissions, or audit logging.
• D. Removing all safety restrictions and guardrails to eliminate the attack surface that bypass attempts target, accepting that this makes the assistant unrestricted for all inputs.

You are rolling out monitoring for a Claude-based deployment and must complete the specification steps before instrumenting the deployment.
Which two steps must be completed BEFORE instrumenting the deployment to emit metrics and traces?
(Select two.)
Each correct answer presents part of the solution.

• A. Tune the alert thresholds based on observed normal-state distributions to reduce false positives.
• B. Define the service-level objectives (SLOs) and the error budgets the deployment will be held to.
• C. Build the dashboards that surface metrics across slices at the cadence the team operates on.
• D. Define the metrics and the slices the deployment will monitor across normal and adversarial traffic.
• E. Document the dashboards, alerts, and runbooks for the on-call rotation that will respond.

You are selecting a model for a new production workload and must complete the upstream steps before testing candidate models empirically.
Which two steps must be completed BEFORE running a representative sample on a candidate model? (Select two.) Each correct answer presents part of the solution.

• A. Choose a candidate model based on the requirements profile and known capabilities.
• B. Retest the model choice when a new model version becomes available.
• C. Define the quality bar, latency tolerance, and expected volume for the workload.
• D. Select the lightest model that consistently meets the quality bar across the sample.
• E. Sign off the production rollout plan with the platform and security teams.

You are defining where human review must remain in a planned automated pipeline. Which placement reflects sound human-in-the-loop design?

• A. Place a human reviewer only after the irreversible action has already executed, making the review a post-hoc audit rather than a meaningful pre-action check or approval gate.
• B. Place a human reviewer in the loop for a randomly selected sample of requests, without defining criteria for what the reviewer should check or which output categories require mandatory review.
• C. Place a human reviewer between the model's output and any high-impact, irreversible action, with explicit criteria for what the reviewer must check before approval.
• D. Remove all human review steps from the pipeline to maximize throughput, accepting that high-impact and irreversible actions will be taken without any human approval or oversight.